{"id":"CVE-2023-32643","aliases":["AZL-28777","BELL-CVE-2023-32643","CLSA-2023-1697135256","CLSA-2023-1697740212","CLSA-2023-1697740947","CLSA-2023-1697741722","CLSA-2023-1697741849","EUVD-2023-36886","GHSA-8jhw-fpw9-r227","JLSEC-2025-163","SUSE-SU-2023:3535-1","UBUNTU-CVE-2023-32643","USN-6165-1","USN-6165-2"],"status":"published","title":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer...","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00375,"percentile":0.31864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-787"],"published":"2023-06-07T00:00:00Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"Azure Linux:2","package":"glib","fixed_in":["2.71.0-4"],"sources":["osv"]},{"ecosystem":"Julia","package":"Glib_jll","fixed_in":["2.76.5+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","fixed_in":["2.40.2-0ubuntu1.1+esm6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","fixed_in":["2.48.2-0ubuntu4.8+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","fixed_in":["2.56.4-0ubuntu0.18.04.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","fixed_in":["2.64.6-1~ubuntu20.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","fixed_in":["2.72.4-0ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"glib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.71.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.1-9.el7_9.tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-fam","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"glib2-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-156.el8.tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-0-refdbg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libglib2.0-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+tuxcare.els2"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-dev-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libglib2.0-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+tuxcare.els1"}]}],"bundled":5},{"source":"osv","ecosystem":"Julia","package":"Glib_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.76.5+0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-150000.4.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-0ubuntu1.1+esm6"}]}],"versions":["2.38.0-1ubuntu1","2.38.1-1","2.39.1-0ubuntu1","2.39.1-0ubuntu2","2.39.1-0ubuntu3","2.39.2-0ubuntu1","2.39.2-0ubuntu2","2.39.3-0ubuntu4","2.39.4-0ubuntu1","2.39.90-0ubuntu1","2.39.91-0ubuntu2","2.39.91-0ubuntu3","2.39.92-2","2.40.0-1","2.40.0-1ubuntu1","2.40.0-2","2.40.2-0ubuntu1","2.40.2-0ubuntu1.1","2.40.2-0ubuntu1.1+esm1","2.40.2-0ubuntu1.1+esm2","2.40.2-0ubuntu1.1+esm3","2.40.2-0ubuntu1.1+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+esm3"}]}],"versions":["2.46.1-1","2.46.1-2","2.47.1-1","2.47.3-3","2.47.4-1","2.47.5-1","2.47.6-1","2.48.0-1ubuntu3","2.48.0-1ubuntu4","2.48.1-1~ubuntu16.04.1","2.48.2-0ubuntu1","2.48.2-0ubuntu3","2.48.2-0ubuntu4","2.48.2-0ubuntu4.1","2.48.2-0ubuntu4.2","2.48.2-0ubuntu4.3","2.48.2-0ubuntu4.4","2.48.2-0ubuntu4.5","2.48.2-0ubuntu4.6","2.48.2-0ubuntu4.7","2.48.2-0ubuntu4.8","2.48.2-0ubuntu4.8+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+esm3"}]}],"versions":["2.54.1-1ubuntu1","2.55.2-2ubuntu1","2.56.0-2ubuntu1","2.56.0-4ubuntu1","2.56.1-2ubuntu1","2.56.2-0ubuntu0.18.04.1","2.56.2-0ubuntu0.18.04.2","2.56.3-0ubuntu0.18.04.1","2.56.4-0ubuntu0.18.04.2","2.56.4-0ubuntu0.18.04.3","2.56.4-0ubuntu0.18.04.4","2.56.4-0ubuntu0.18.04.5","2.56.4-0ubuntu0.18.04.6","2.56.4-0ubuntu0.18.04.7","2.56.4-0ubuntu0.18.04.8","2.56.4-0ubuntu0.18.04.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.64.6-1~ubuntu20.04.6"}]}],"versions":["2.62.1-1","2.63.1-2","2.63.1-2ubuntu1","2.63.3-1","2.63.3-3","2.63.5-2","2.64.0-1","2.64.1-1","2.64.2-1~fakesync1","2.64.3-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.1","2.64.6-1~ubuntu20.04.2","2.64.6-1~ubuntu20.04.3","2.64.6-1~ubuntu20.04.4"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.72.4-0ubuntu2.2"}]}],"versions":["2.68.4-1ubuntu1","2.70.1-1","2.70.2-1","2.71.0-2","2.71.1-1","2.71.2-1","2.71.3-1","2.72.0-1","2.72.1-1","2.72.4-0ubuntu1","2.72.4-0ubuntu2"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.40.2-0ubuntu1.1+esm6"}]}],"versions":["2.38.0-1ubuntu1","2.38.1-1","2.39.1-0ubuntu1","2.39.1-0ubuntu2","2.39.1-0ubuntu3","2.39.2-0ubuntu1","2.39.2-0ubuntu2","2.39.3-0ubuntu4","2.39.4-0ubuntu1","2.39.90-0ubuntu1","2.39.91-0ubuntu2","2.39.91-0ubuntu3","2.39.92-2","2.40.0-1","2.40.0-1ubuntu1","2.40.0-2","2.40.2-0ubuntu1","2.40.2-0ubuntu1.1","2.40.2-0ubuntu1.1+esm1","2.40.2-0ubuntu1.1+esm2","2.40.2-0ubuntu1.1+esm3","2.40.2-0ubuntu1.1+esm4"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.48.2-0ubuntu4.8+esm3"}]}],"versions":["2.46.1-1","2.46.1-2","2.47.1-1","2.47.3-3","2.47.4-1","2.47.5-1","2.47.6-1","2.48.0-1ubuntu3","2.48.0-1ubuntu4","2.48.1-1~ubuntu16.04.1","2.48.2-0ubuntu1","2.48.2-0ubuntu3","2.48.2-0ubuntu4","2.48.2-0ubuntu4.1","2.48.2-0ubuntu4.2","2.48.2-0ubuntu4.3","2.48.2-0ubuntu4.4","2.48.2-0ubuntu4.5","2.48.2-0ubuntu4.6","2.48.2-0ubuntu4.7","2.48.2-0ubuntu4.8","2.48.2-0ubuntu4.8+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glib2.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.56.4-0ubuntu0.18.04.9+esm3"}]}],"versions":["2.54.1-1ubuntu1","2.55.2-2ubuntu1","2.56.0-2ubuntu1","2.56.0-4ubuntu1","2.56.1-2ubuntu1","2.56.2-0ubuntu0.18.04.1","2.56.2-0ubuntu0.18.04.2","2.56.3-0ubuntu0.18.04.1","2.56.4-0ubuntu0.18.04.2","2.56.4-0ubuntu0.18.04.3","2.56.4-0ubuntu0.18.04.4","2.56.4-0ubuntu0.18.04.5","2.56.4-0ubuntu0.18.04.6","2.56.4-0ubuntu0.18.04.7","2.56.4-0ubuntu0.18.04.8","2.56.4-0ubuntu0.18.04.9"],"bundled":5}],"products":[{"vendor":"glib","product":"glib"},{"vendor":"gnome","product":"glib"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/glib/-/issues/2840","tags":["x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835","tags":["x_transferred","Broken Link","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0005/","tags":["x_transferred","advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32643","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240426-0005"},{"url":"https://github.com/advisories/GHSA-8jhw-fpw9-r227"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-32643","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos7-els/CLSA-2023-1697135256.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2023-1697740212.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2023-1697740947.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04-els/CLSA-2023-1697741722","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18_04-els/CLSA-2023-1697741849","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32643.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233535-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183533","tags":["report"]},{"url":"https://bugzilla.suse.com/1211945","tags":["report"]},{"url":"https://bugzilla.suse.com/1211946","tags":["report"]},{"url":"https://bugzilla.suse.com/1211947","tags":["report"]},{"url":"https://bugzilla.suse.com/1211948","tags":["report"]},{"url":"https://bugzilla.suse.com/1211951","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-29499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32611","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-32665","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-32643","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-32643","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6165-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6165-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-32643","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-24593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-29499","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32611","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32636","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-32665","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-32643","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T19:14:56.761Z","modified":"2026-10-14T23:17:12.028Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:35:29.381004Z"}],"euvd":[{"id":"EUVD-2023-36886","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T19:14:56Z","modified":"2026-10-14T23:17:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-8jhw-fpw9-r227","title":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer...","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T21:30:26Z","modified":"2026-10-15T00:30:42Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T15:13:29.914076Z"}],"nvd":[{"id":"CVE-2023-32643","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T20:15:09.77Z","modified":"2026-10-15T00:16:32.663Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-122","CWE-787"],"updated_at":"2026-11-02T14:08:29.595868Z"}],"osv":[{"id":"AZL-28777","title":"CVE-2023-32643 affecting package glib for versions less than 2.71.0-4","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T20:15:09Z","modified":"2026-04-21T04:25:59.464146Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"BELL-CVE-2023-32643","title":"CVE-2023-32643 does not affect BellSoft software","status":"withdrawn","published":"2023-09-14T20:15:00Z","modified":"2026-01-26T09:47:17.607213Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-32643","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-09-14T19:14:56.761Z","modified":"2026-10-28T02:30:53.917021075Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"JLSEC-2025-163","title":"A flaw was found in GLib","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2025-10-19T22:31:43.957Z","modified":"2026-07-18T00:00:21.772294902Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"UBUNTU-CVE-2023-32643","description":"A flaw was found in GLib. The GVariant deserialization code is vulnerable to a heap buffer overflow introduced by the fix for CVE-2023-32665. This bug does not affect any released version of GLib, but does affect GLib distributors who followed the guidance of GLib developers to backport the initial fix for CVE-2023-32665.","status":"published","published":"2023-06-07T00:00:00Z","modified":"2026-04-22T14:07:18.92005Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"CLSA-2023-1697135256","title":"glib2: Fix of 5 CVEs","description":"- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-12T18:27:40Z","modified":"2026-10-21T10:47:52.3041045Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697740212","title":"glib2: Fix of 5 CVEs","description":"- Enable internal tests\n- Skip several failed tests from the check\n- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-19T18:30:17Z","modified":"2026-10-21T10:48:16.247505036Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697740947","title":"glib2: Fix of 5 CVEs","description":"- Enable internal tests\n- Skip several failed tests from the check\n- CVE-2023-29499: Fix GVariant offset table entry size which is not checked\n  in is_normal()\n- CVE-2023-32611: Fix an issue where g_variant_byteswap() can take a long time\n  with some non-normal inputs\n- CVE-2023-32665: Fix GVariant deserialisation which does not match spec\n  for non-normal data\n- CVE-2023-32636: Fix a wrong timeout in fuzz_variant_text()\n- CVE-2023-32643: Fix a heap-buffer-overflow in g_variant_serialised_get_child()\n- Fix g_test_bug assertion in gvariant test","status":"published","published":"2023-10-19T18:42:31Z","modified":"2026-10-21T10:48:07.192502033Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697741722","title":"Fix of 5 CVEs","description":"\n   * SECURITY UPDATE: GVariant security issues\n     - debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple\n       GVariant serialization issues\n     - CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643,\n       CVE-2023-32665\n   * debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion\n     in gvariant test\n   * debian/patches/libglib2.0-0.symbols: Add new symbols","status":"published","published":"2023-10-19T18:55:27Z","modified":"2026-06-04T10:03:37.244723421Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"CLSA-2023-1697741849","title":"Fix of 5 CVEs","description":"\n   * SECURITY UPDATE: GVariant security issues\n     - debian/patches/CVE-2023-29499-x-CVE-2023-32665/*.patch: fix multiple\n       GVariant serialization issues\n     - CVE-2023-29499, CVE-2023-32611, CVE-2023-32636, CVE-2023-32643,\n       CVE-2023-32665\n   * debian/patches/fix-g_test_bug-assertion.patch: Fix g_test_bug assertion\n     in gvariant test\n   * debian/patches/skip-several-failed-tests.patch: Skip several failed tests\n   * debian/patches/libglib2.0-0.symbols: Add new symbol","status":"published","published":"2023-10-19T18:57:34Z","modified":"2026-06-04T10:04:16.64485Z","updated_at":"2026-11-02T15:43:40.509998Z"},{"id":"SUSE-SU-2023:3535-1","title":"Security update for glib2","description":"This update for glib2 fixes the following issues:\n\n- CVE-2021-28153: Fixed an issue where symlink targets would be incorrectly created as empty files. (bsc#1183533)\n- CVE-2023-32665: Fixed GVariant deserialisation which does not match spec for non-normal data. (bsc#1211945)\n- CVE-2023-32643: Fixed a heap-buffer-overflow in g_variant_serialised_get_child(). (bsc#1211946)\n- CVE-2023-29499: Fixed GVariant offset table entry size which is not checked in is_normal(). (bsc#1211947)\n- CVE-2023-32636: Fixed a wrong timeout in fuzz_variant_text(). (bsc#1211948)\n- CVE-2023-32611: Fixed an issue where g_variant_byteswap() can take a long time with some non-normal inputs. (bsc#1211951)\n","status":"published","published":"2023-09-05T12:47:12Z","modified":"2026-02-04T02:52:08.989259Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6165-1","title":"glib2.0 vulnerabilities","description":"It was discovered that GLib incorrectly handled non-normal GVariants. An\nattacker could use this issue to cause GLib to crash, resulting in a denial\nof service, or perform other unknown attacks.\n","status":"published","published":"2023-06-14T13:26:19Z","modified":"2026-04-22T10:35:45.827987Z","updated_at":"2026-11-02T16:58:16.738762Z"},{"id":"USN-6165-2","title":"glib2.0 vulnerabilities","description":"USN-6165-1 fixed vulnerabilities in GLib. This update provides the\ncorresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that GLib incorrectly handled non-normal GVariants. An\n attacker could use this issue to cause GLib to crash, resulting in a\n denial of service, or perform other unknown attacks.\n","status":"published","published":"2023-10-19T11:46:21Z","modified":"2026-06-29T13:50:52.884865447Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}